The Japanese keyword hack is beating WordFence and Sucuri this week. Your real tripwire is in GSC.

The Japanese keyword hack is having a moment. Reports this week have a fresh wave chewing through WordPress sites and walking straight past WordFence, Sucuri and Malcare. Plugin says clean, site is not.

Quick anatomy for anyone who has not met it: the hack generates pages of autogenerated Japanese text in random directories on your domain, things like yoursite.com/ltjmnjp/341.html, stuffed with affiliate links to counterfeit goods. The pages are cloaked -> you click one and get a 404, Googlebot gets a live page. So browsing your own site tells you nothing.


Three checks that actually catch it:

• Search Console -> Users and permissions. This hack verifies ITSELF as an owner of your property, usually via a dropped verification file or an .htaccess rewrite. An owner you do not recognize is the loudest tell there is, and no security plugin is watching that page for you.
• site:yourdomain.com, scan for Japanese titles. Nothing on Google? Run the same search on Bing, Google sometimes drops the junk pages before you get around to looking.
• URL Inspection on any suspicious path. 404 in your browser but real content in the render = you are hit.

If you are hit, order matters. Kick the rogue owner out first and delete their verification token, or they walk back in after your cleanup. Then a clean .htaccess, reinstall CMS core, and grep the codebase for base64_decode and eval before you trust anything. All of this is sitting in Google's own hacked-site doc, it just gets ignored because everyone assumes the plugin has the door covered.

Anyone eaten this wave in the last couple of weeks? Curious what caught it first for you: the plugin, a GSC message, or a customer asking why you sell Gucci now.

This is creative and unique, is this limited to only wordpress sites? To be sure my other sites aren't affected.

HenryObi said:

is this limited to only wordpress sites

Click to expand...

WordPress first, but not WordPress only. The wave lands there because that is where the vulnerable plugins and stale themes are, the mechanism does not care what CMS you run -> anywhere an attacker can write files can host the cloaked pages, and the rogue-owner trick in GSC works on every platform. So the two minute version for your other sites: open Users and permissions on each property and make sure you recognise every owner. Clean owner list plus no Japanese titles in the site: results and you are fine.

gasol1 said:

patch the original entry point

Click to expand...

That is the step people skip, then they are back in this thread a fortnight later. Cleaning the pages without closing the hole is just mowing the weeds. One add to your list: pull the access logs the same day you find it. Cheap shared hosts rotate logs off in days, and once they are gone you will never know which plugin let them in.